[danielgorgonha]

What & why

Third step of the fee release (#847): the coordinator may build at the lower network fee ZIP 2009 allows (1,000 zatoshis per action from block 3,590,000), but only for a vault whose every seat reported that its device accepts it, and only when the operator turns the switch off. By default nothing changes: the switch is ON and every vault keeps paying 5,000 per action.

Why one piece: the permission, the builder and the guard only make sense together. Split, the builder would read a permission with nothing checking what it built, or the guard would check a rule nothing builds to. The pieces:

• konclave-seal: one function gives the builder's fee rule (fee_rule_for, with one predicate for when the lower fee is in force), and one reader gives a PCZT's fee and action count (spends::bundle_fee), used by the device and by the coordinator's guard. A table test pins that every era accepts 5,000.
• konclave-signer: build-payroll takes --zip2009-permitted --zip2009-from <height> and picks the marginal from the wallet's own target height (ZIP 2009 says the mining height).
• orchestrator: vault_fee_permission decides per vault from B2's seat reports (feat(helper): each seat reports the fee era its device accepts (#847) #945): permitted only with the switch off and every seat reported; the height is the larger of the table's and the reports', so a report cannot bring the era earlier. The funding check at proposal time stays at 5,000. Between build and proof, guard_built_fee reads the coordinator's own PCZT and refuses it if its fee is not in the permitted set at tip+1, and refuses outright when the tip is unknown.
• helper-server: the switch is KONCLAVE_FEE_MARGINAL_MAX, where absent or 5000 means ON and per-vault means OFF. Any other value refuses to boot. The boot line says which mode it runs in.
• The browser package is rebuilt from source (reproducible with wasm-pack 0.13.1; sha256 checked by the audit).

Known limit (in helper-server/CHANGELOG.md): a seat's report is self-declared, and two devices of one seat share one registration, so the coordinator can build at 1,000 where a signing device still refuses it. That device then refuses the ceremony. The effect is on availability, never on funds; the device's own fee check is the defence and KONCLAVE_FEE_MARGINAL_MAX=5000 the remedy.

Rollout: deploy with the switch ON; it goes off only after a 1,000 send on staging after block 3,590,000.

Verify-before-finishing checklist

• cargo fmt --check + cargo clippy -- -D warnings pass (konclave-seal, konclave-signer, konclave-wasm, orchestrator, helper-server); wasm32 release build
• cargo test --no-fail-fast on the five crates: all pass except the known timing flake a_history_sync_and_a_funding_check_never_overlap_and_sync_once (helper-server, it fails on staging too); ui/ suites run in CI
• Mutation round: 16 of 16 killed; new tip-0 test red-checked without the guard
• No secret, key share, seed, or passphrase in code, logs, URLs, or query strings
• Every fund-moving path keeps preview + explicit confirmation
• Reviewed: code, tester, security (plus a delta round on the fixes)
• CHANGELOG: changelog.d and helper-server/
• Docs/comments in English; commits are type(scope): description
• AI disclosure: written with Claude Code, reviewed by the author, who answers for every line. Commits carry Co-Authored-By: Claude <noreply@anthropic.com>. No session link.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
konclave-demo	Ready	Preview	Nov 13, 2026 11:12am UTC